Jann Horn
b70eb420e9
bpf: Fix tnum constraints for 32-bit comparisons ...
[ Upstream commit 604dca5e3af1db98bd123b7bfc02b017af99e3a0 ]
The BPF verifier tried to track values based on 32-bit comparisons by
(ab)using the tnum state via 581738a681b6 ("bpf: Provide better register
bounds after jmp32 instructions"). The idea is that after a check like
this:
if ((u32)r0 > 3)
exit
We can't meaningfully constrain the arithmetic-range-based tracking, but
we can update the tnum state to (value=0,mask=0xffff'ffff'0000'0003).
However, the implementation from 581738a681b6 didn't compute the tnum
constraint based on the fixed operand, but instead derives it from the
arithmetic-range-based tracking. This means that after the following
sequence of operations:
if (r0 >= 0x1'0000'0001)
exit
if ((u32)r0 > 7)
exit
The verifier assumed that the lower half of r0 is in the range (0, 0)
and apply the tnum constraint (value=0,mask=0xffff'ffff'0000'0000) thus
causing the overall tnum to be (value=0,mask=0x1'0000'0000), which was
incorrect. Provide a fixed implementation.
Fixes: 581738a681b6 ("bpf: Provide better register bounds after jmp32 instructions")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200330160324.15259-3-daniel@iogearbox.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-04-17 10:50:25 +02:00
bpf: Fix tnum constraints for 32-bit comparisons
2020-04-17 10:50:25 +02:00
cgroup1: don't call release_agent when it is ""
2020-04-01 11:01:51 +02:00
kgdb: don't use a notifier to enter kgdb at panic; call directly
2019-09-25 17:51:40 -07:00
dma-mapping: Fix dma_pgprot() for unencrypted coherent pages
2020-04-17 10:50:01 +02:00
perf/core: Fix mlock accounting in perf_mmap()
2020-02-11 04:35:54 -08:00
Revert "um: Enable CONFIG_CONSTRUCTORS"
2020-02-01 09:34:53 +00:00
genirq/debugfs: Add missing sanity checks to interrupt injection
2020-04-17 10:50:11 +02:00
locking/lockdep: Avoid recursion in lockdep_count_{for,back}ward_deps()
2020-04-17 10:50:05 +02:00
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
2020-02-19 19:52:56 +01:00
printk: fix exclusive_console replaying
2020-02-24 08:36:24 +01:00
rcu: Allow only one expedited GP to run concurrently with wakeups
2020-03-05 16:43:50 +01:00
sched/core: Remove duplicate assignment in sched_tick_remote()
2020-04-17 10:50:17 +02:00
time/sched_clock: Expire timer in hardirq context
2020-04-17 10:50:02 +02:00
ftrace/kprobe: Show the maxactive number on kprobe_events
2020-04-17 10:50:21 +02:00
audit: always check the netlink payload length in audit_receive_msg()
2020-03-05 16:43:42 +01:00
audit_get_nd(): don't unlock parent too early
2019-11-10 11:56:55 -05:00
audit: fix error handling in audit_data_to_entry()
2020-03-05 16:43:42 +01:00
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
2020-04-17 10:50:11 +02:00
keys: Fix request_key() cache
2020-01-17 19:48:42 +01:00
kernel/elfcore.c: include proper prototypes
2019-09-25 17:51:39 -07:00
exit: panic before exit_mm() on global init exit
2020-01-09 10:20:01 +01:00
mm: fork: fix kernel_stack memcg stats for various stack implementations
2020-04-01 11:02:03 +02:00
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
futex: Unbreak futex hashing
2020-03-25 08:25:58 +01:00
kheaders: substituting --sort in archive creation
2019-10-17 09:08:19 +09:00
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol
2019-08-27 16:19:56 +01:00
kexec: bail out upon SIGKILL when allocating memory.
2019-09-25 17:51:40 -07:00
kexec_elf: support 32 bit ELF files
2019-09-06 23:58:44 +02:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
2020-03-12 13:00:09 +01:00
kthread: make __kthread_queue_delayed_work static
2019-10-16 09:20:58 -07:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
module: avoid setting info->name early in case we can fall back to info->mod->name
2020-02-24 08:36:54 +01:00
x86/mm: split vmalloc_sync_all()
2020-03-25 08:25:58 +01:00
padata: always acquire cpu_hotplug_lock before pinst->lock
2020-04-08 09:08:47 +02:00
panic: ensure preemption is disabled during panic()
2019-10-07 15:47:19 -07:00
ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
2020-01-23 08:22:36 +01:00
mm/memory_hotplug.c: use PFN_UP / PFN_DOWN in walk_system_ram_range()
2019-09-24 15:54:09 -07:00
seccomp: Add missing compat_ioctl for notify
2020-04-17 10:50:09 +02:00
signal: Extend exec_id to 64bits
2020-04-17 10:50:12 +02:00
stacktrace: Don't skip first entry on noncurrent tasks
2019-11-04 21:19:25 +01:00
stop_machine: Avoid potential race behaviour
2019-10-17 12:47:12 +02:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-09-17 12:35:15 -07:00
kernel: sysctl: make drop_caches write-only
2020-01-04 19:18:32 +01:00
taskstats: fix data-race
2020-01-09 10:19:54 +01:00
watchdog/softlockup: Enforce that timestamp is valid on boot
2020-02-24 08:36:52 +01:00
workqueue: don't use wq_select_unbound_cpu() for bound works
2020-03-18 07:17:50 +01:00
b70eb420e9